On 10-07-16 11:46, Gary Gatten at [email protected] wrote : > As for interfaces, it includes logical interfaces (VLANs, SVI's, etc.) and the > interfaces numbers are determined by IOS - I forget how, but you can view > them by: "show snmp mib ifmib ifindex". So, you will get some sort of display > for each unique interface from each unique exporter. If the number of > interfaces ntop sees are much different than the number of interfaces on your > exporter (6500), then something is not right.
Hello, I was happy to see that ntop ran for the whole weekend without any major problems. This morning I have 245 directories in rrd/interfaces/NetFlow-device.2/NetFlow: much better than the thousands I had after running 10-15 minutes before, but still more than the number of "ifindex" reported by the command suggested by Gary. The result of the "show snmp mib ifmib ifindex" shows that there are 93 VLANs reported by the actual netflow config (that's much more than I thought). The indexes are numbered sequentially from 1 to 93 (they are not listed in order but I sorted the list). Should these numbers correspond to what I see in the "Interface Name/Id" column in the "Plugins => NetFlow => Statistics" page? Because they don't. As mentioned before, I have 3 sections in the "Netflow Statistics" page: "Device 1 - NeFlow-device.2" with the following Inderface ids: 42, 44, 50, 51, 52, 53, 54, 55, 56, 57, 59 and 60. "Device 2 - NeFlow-device.2" with the following Inderface ids: 0, 1, 28, 42, 43, 44, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 76, 77, 78, 79, 84, 112, 144, 154, 156, 157, 158, 224, 234, 235, 237, 240, 252, 257, 288, 312, 335, 390, 395, 420, 471, 546, 547, 1020, 7253, 7331, 13995, 62636 "Device 3 - NeFlow-device.2" with all the interface ids of "Device 2" above, plus the following additional Inderface ids: 68, 69, 70, 82, 95, 96, 100, 116, 120, 132, 137, 155, 168, 170, 174, 180, 192, 198, 206, 208, 232, 233, 236, 260, 274, 300, 311, 313, 314, 315, 316, 320, 327, 336, 360, 264, 380, 384, 389, 391, 392, 393, 394, 406, 416, 426, 432, 456, 467, 468, 469, 472, 473, 474, 480, 504, 520, 540, 545, 548, 549, 551, 552, 553, 576, 600, 623, 624, 626, 628, 630, 631, 632, 639, 656, 660, 684, 701, 702, 706, 707, 709, 710, 711, 720, 780, 782, 785, 786, 788, 789, 790, 840, 857, 858, 862, 867, 868, 869, 900, 924, 936, 946, 947, 960, 984, 1013, 1014, 1019, 1021, 1025, 1026, 1027, 1080, 1091, 1092, 1104, 1105, 1140, 1164, 1170, 1183, 1185, 1188, 1200, 1212, 1248, 1252, 1260, 1264, 1272, 1308, 1320, 1326, 1341, 1368, 1380, 1404, 1482, 1488, 1492, 1559, 1565, 1577, 1578, 1596, 1638, 1656, 1657, 1716, 1735, 2028, 2074, 2277, 2340, 2982, 3493, 3653, 3693, 3749, 4093, 5387, 7235, 7329, 7332, 7409, 7410, 7411, 61118, 61250, 61382, 61580, 61712, 61778, 6/884, 62042, 62108, 62174, 62372, 62438, 62504, 62570, 62702, 62768, 62834, 62900, 62933, 62966, 63032, 63164 As you can see, there are a lot of Interface IDs greater than 93. Gary said: > If the number of interfaces ntop sees are much different than the number > of interfaces on your exporter (6500), then something is not right. It seems that something is, indeed, not right. Any ideas? By the way, what do the Netflow statistics actually mean? Is it the number of bytes and packets of the Netflow records themselves, or the total number of bytes and packets of the flows reported by the Netflow records? Thanks, Marc. -- Marc Mazuhelli, CISSP, GSEC Computer security analyst Service des technologies de l'information Université de Sherbrooke _______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
